Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26/12/2023, 00:27
General
-
Target
4659c37012a464fa494af2c70d075aba.exe
-
Size
413KB
-
MD5
4659c37012a464fa494af2c70d075aba
-
SHA1
0a2012de48575a20c14d043bb7c4f612a09f5979
-
SHA256
7bf55bac5b9c5cd7962f897170cf83a7af56a6f058b266119d0c151fc3a906a8
-
SHA512
fedb0bdf66d1c49d321c41a7ad021a54e08265ef69499d479f68890a5dddcfcad70d98d393d1e969bae2be68ba33c7a213995a07a811d1cff7fe30c9b41b9b60
-
SSDEEP
12288:JNDOEZMhHBCCF3Z4mxxy7sIcOa/Y91TVKq:J1OEZM7QmXcsINwrq
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 5 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4659c37012a464fa494af2c70d075aba.exe"C:\Users\Admin\AppData\Local\Temp\4659c37012a464fa494af2c70d075aba.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\Deleteme.bat2⤵
- Deletes itself
-
-
C:\Windows\SysWOW64\kanwi.exeC:\Windows\SysWOW64\kanwi.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD5adff8c2a394e3eeb6ddc7191495c6eef
SHA128c9122ba1da850105c82a573ede728eed20cb20
SHA25692f70f55506ba44d7663fb18403aa4d62233597a56467df6ab861fd4797cbd82
SHA512b0a9bd13d11281ddaefee4a3962c8d7903477e5f3671425a05c47ec5f53f33ff9cd3f2089884a37995f36f69a3f9aad2d4697ed4a51180bfd1bc284151873eab
-
Filesize
413KB
MD54659c37012a464fa494af2c70d075aba
SHA10a2012de48575a20c14d043bb7c4f612a09f5979
SHA2567bf55bac5b9c5cd7962f897170cf83a7af56a6f058b266119d0c151fc3a906a8
SHA512fedb0bdf66d1c49d321c41a7ad021a54e08265ef69499d479f68890a5dddcfcad70d98d393d1e969bae2be68ba33c7a213995a07a811d1cff7fe30c9b41b9b60
-
Filesize
214KB
MD519632f942e124df37176a507286c2d99
SHA1b18ce35cc4e34097f6b607f100102e78bcfcb305
SHA256093708e66a0a0bbbd3565e88d9d139f969e0d741443d59f52eb2421b316e1e55
SHA5120e4b7759e9992f8880f529b21adb33809e46d0f34b74b7ff24798d96589838be21da3fcac51fa6a52ded8784fb40353b9cf12608a597c7b92168cd84e842a518
-
Filesize
528KB
-
Filesize
528KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
528KB
-
Filesize
528KB